0xThiebaut

DFIR & RE at @NVISOsecurity . Bringing custom tools to custom problems.

@NVISOsecurity Belgium

Pinned Repositories

BadBlood
BadBlood by @davidprowe, Secframe.com, fills a Microsoft Active Directory Domain with a structure and thousands of objects. The output of the tool is a domain similar to a domain in the real world. After BadBlood is ran on a domain, security analysts and engineers can practice using tools to gain an understanding and prescribe to securing Active D
Language:PowerShell0 1 00
ctfd-koth
A CTFd King of the Hill binary.
Language:Go2 2 01
dnsbeat
An Elasticsearch Beat to monitor DNS zones through customizable zone transfers.
Language:Go13 2 14
dnsbeat-poc
A proof-of-concept for 0xThiebaut/dnsbeat.
1 2 00
IDA
⚙️ Things I used in IDA...
Language:C2 2 01
mdeproxy
Microsoft Defender for Endpoint Proxy (Device Timeline, ...)
Language:Go3 1 00
PCAPeek
A proof-of-concept re-assembler for reverse VNC traffic.
Language:Go25 3 02
sigmai
Import specific data sources into the Sigma generic and open signature format.
Language:Go78 9 05
Signatures
🚧 Currently transfering TLP:CLEAR rules from TLP:AMBER repository...
Language:YARA21 3 14
Zipit
A Firefox extension to encrypt files downloaded through Microsoft 365 Defender's Live Response Sessions.
Language:TypeScript1 2 10

0xThiebaut's Repositories

0xThiebaut/PCAPeek
A proof-of-concept re-assembler for reverse VNC traffic.
Language:Go25 3 02
0xThiebaut/Signatures
🚧 Currently transfering TLP:CLEAR rules from TLP:AMBER repository...
Language:YARA21 3 14
0xThiebaut/mdeproxy
Microsoft Defender for Endpoint Proxy (Device Timeline, ...)
Language:Go3 1 00
0xThiebaut/IDA
⚙️ Things I used in IDA...
Language:C2 2 01
0xThiebaut/CCCS-Yara
YARA rule metadata specification and validation utility / Spécification et validation pour les règles YARA
Language:Python0 1 00
0xThiebaut/CyberChef
The Cyber Swiss Army Knife - a web app for encryption, encoding, compression and data analysis
Language:JavaScript1 0
0xThiebaut/DefenderHarvester
Expose a lot of MDE telemetry that is not easily accessible in any searchable form
Language:Go0 0
0xThiebaut/DidierStevensSuite
Please no pull requests for this repository. Thanks!
Language:Python1 0
0xThiebaut/elastic-agent-system-metrics
Language:Go0 0
0xThiebaut/FortilogDecoder
Language:Python0 0
0xThiebaut/IvantiInitrdDecryptor
Language:Python0 0
0xThiebaut/libtorrent
an efficient feature complete C++ bittorrent implementation
Language:C++0 0
0xThiebaut/malduck
:duck: Malduck is your ducky companion in malware analysis journeys
Language:Python1 0
0xThiebaut/mwdb-core
Malware repository component for samples & static configuration with REST API interface.
Language:Python1 0
0xThiebaut/opnsense-core
OPNsense GUI, API and systems backend
0xThiebaut/opnsense-plugins
OPNsense plugin collection
Language:PHP0 0
0xThiebaut/opnsense-ports
OPNsense ports on top of FreeBSD
Language:Makefile0 0
0xThiebaut/opnsense-tools
OPNsense release engineering toolkit
Language:Shell0 0
0xThiebaut/qBittorrent
qBittorrent BitTorrent client
Language:C++0 0
0xThiebaut/signature-base
YARA signature and IOC database for my scanners and tools
Language:YARA1 0
0xThiebaut/speakeasy
Windows kernel and user mode emulation.
Language:Python1 0
0xThiebaut/SQLiteHunter
Hunt for SQLite files used by various applications
Language:Go1 0
0xThiebaut/The-DFIR-Report-Sigma
The DFIR Report's Sigma Rules
1 0
0xThiebaut/Tools
Tools and scripts
Language:Python2 0
0xThiebaut/traefik-helm-chart
Traefik Proxy Helm Chart
0xThiebaut/uac
UAC is a Live Response collection script for Incident Response that makes use of native binaries and tools to automate the collection of AIX, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris systems artifacts.
Language:Shell0 0
0xThiebaut/velociraptor
Digging Deeper....
Language:Go1 0
0xThiebaut/winget-pkgs
The Microsoft community Windows Package Manager manifest repository
Language:PowerShell1 0
0xThiebaut/wireproxy
Wireguard client that exposes itself as a socks5 proxy
Language:Go0 0
0xThiebaut/yara-x
A rewrite of YARA in Rust.